CVE-2026-86415
NONE—CVSS v3
—CVSS v2
0.17%
EPSS (exploit probability)
—CWE
Description
libcurl's connection cache match function never considers the automatic client
certificate option, so a cached, already authenticated Schannel connection can
be handed to a transfer that got redirected to a different origin, even though
the code explicitly switched off the auto client cert option for that transfer
to prevent exactly this.
Affected routers (0)
No routers currently mapped to this CVE in our database.